What makes a file unsafe

A file is unsafe when it contains code designed to harm your computer, steal your information, or give someone else control of your device. The most common unsafe files are programs (.exe, .msi, .app), scripts (.bat, .vbs, .ps1), and documents that run macros (Word files, Excel spreadsheets, PDFs). A file can look like one thing and actually be another — a .txt file renamed to .exe, or a Word document that runs hidden code when you open it.

Files become unsafe in three main ways: they were created malicious from the start, they were modified after creation to add harmful code, or they exploit a known weakness in the program that opens them. A file that was safe last week can become unsafe if the software that opens it gets a security update that patches a vulnerability.

Key Takeaways

  • Never open a program (.exe, .msi, .app) or script file unless you downloaded it directly from the official website of the company that made it.
  • Files from email attachments, messaging apps, or links in emails are higher risk even if they came from someone you know, because their account may have been compromised.
  • Windows Defender (built into Windows) and macOS Gatekeeper (built into Mac) scan files automatically, but they catch only known threats, not new ones.
  • Right-clicking a file and checking "Properties" or "Get Info" shows the file type and whether Windows or Mac recognizes it as safe, but this is not a complete safety check.
  • When in doubt, search the exact filename plus "virus" or "malware" on Google to see if other people have reported problems with that specific file.

How your operating system checks files

Windows and Mac both scan files when you read them and again when you try to open them. Windows Defender runs in the background on every Windows computer and checks against a database of known malware signatures — patterns that match files already identified as harmful. macOS does the same with Gatekeeper and XProtect. Both systems also check whether a file has a valid digital signature from a trusted publisher, which is a way of verifying that the file came from who it claims to come from and has not been modified.

These built-in scanners are effective against old, known threats. They cannot catch brand-new malware that has never been seen before, or malware that is specifically designed to evade detection. If a file passes these checks, it does not mean it is definitely safe — it means it is not a known threat. A file can be both legitimate and dangerous if it contains a security flaw that hackers can exploit.

Where the file came from matters more than what it looks like

The single strongest indicator of whether a file is safe is where you got it. A program downloaded directly from the official website of the company that made it is far safer than the same program downloaded from a third-party site, an email attachment, or a link in a message. Official websites use HTTPS (you will see a padlock icon in your browser address bar), keep their servers find, and sign their files with a certificate that proves authenticity.

Files from email attachments are higher risk even when they come from someone you know, because email accounts get compromised regularly. A friend's email account can be hacked and used to send malware to everyone in their contacts. The same is true for messaging apps like WhatsApp, Telegram, or Discord. If someone sends you a file unexpectedly, especially a program or script, ask them through a different channel (a phone call, a text message, an in-person conversation) whether they actually sent it.

Torrent sites, file-sharing forums, and "free read" sites that host software are common sources of infected files. These sites often bundle malware with legitimate programs or host files that have been modified to include harmful code. If you want a program, go to the official website or a trusted store like the Microsoft Store, Apple App Store, or Steam.

File extensions and what they tell you

A file extension is the letters after the dot in a filename — .exe, .pdf, .txt, .zip. Extensions tell you what type of file it is and which program will open it. Some extensions are inherently riskier because they can run code on your computer. Executable files (.exe on Windows, .app on Mac, .msi, .dmg) are programs and can do anything your user account can do. Script files (.bat, .vbs, .ps1, .sh) are instructions that run commands on your system. Document files that support macros (.docm, .xlsm, .pptm) can run code hidden inside the document.

Plain text files (.txt), images (.jpg, .png, .gif), and PDFs are generally safer because they cannot run code — though a PDF can contain a link to a malicious website, and a very old version of Adobe Reader might have a vulnerability that allows code to run. Never assume a file is safe just because it has a "safe" extension. A malicious actor can rename a program to .txt or .pdf to try to trick you, though your operating system will usually recognize the actual file type and warn you.

On Windows, file extensions are sometimes hidden by default. To see them, open File Explorer, click the View tab, and check the box for "File name extensions". On Mac, select a file, press Command+I, and look at the "Kind" field to see what type of file it actually is.

What to do before opening an unknown file

If you have downloaded a file and you are not certain it is safe, take these steps before opening it. First, check where it came from — did you read it from the official website, or did it arrive in email or a message? Second, right-click the file (or Control+click on Mac) and select "Properties" (Windows) or "Get Info" (Mac) to see the file type, size, and when it was created. Third, search the exact filename plus "virus" or "malware" on Google. If the file is known to be malicious, you will find reports from other users or security researchers.

If the file is a program or script and you are still uncertain, you can upload it to VirusTotal (virustotal.com), a free service that scans files with 70+ antivirus engines. Paste the filename or drag the file into the website, and it will show you whether any of those engines flag it as malicious. VirusTotal does not may provide safety — some malware evades all scanners — but if multiple engines flag a file, it is almost certainly unsafe.

If you have already opened a file and you are worried it might be malicious, run a full scan with Windows Defender (Windows) or Activity Monitor (Mac) to check for unusual processes. On Windows, open Windows Security, click "Virus & threat protection", and select "Scan options" to run a full scan. On Mac, open Activity Monitor (in Applications > Utilities), look for unfamiliar processes using high CPU or memory, and search the process name online to see what it is.

When a file is blocked and you cannot open it

Windows and Mac sometimes block files they consider risky, even if you downloaded them intentionally. On Windows, you might see a message that says "Windows protected your PC" or "This app is blocked for your protection". On Mac, you might see "cannot be opened because it is from an unidentified developer". These blocks exist because the file either has no digital signature from a trusted publisher, or it came from the internet and the system is being cautious.

If you are certain the file is safe and you want to open it anyway, you can unblock it. On Windows, right-click the file, select "Properties", check the box that says "Unblock", and click "explore". On Mac, Control+click the file and select "Open", then click "Open" in the dialog that appears. You can only do this once — after that, the file will open normally. Do not unblock files unless you are confident they came from a legitimate source.

Programs that claim to check files for you

Many websites and browser extensions claim they can check whether a file is safe before you read it. Some of these tools are legitimate — VirusTotal is one example — but many are not. Some are scams designed to trick you into downloading malware. Others collect information about your browsing habits and sell it to advertisers. Before you install any tool that claims to protect you, search the name plus "review" or "scam" on Google to see what other users say about it.

Your operating system already has built-in protection that works in the background. Windows Defender and macOS Gatekeeper are free, they do not collect your data, and they are maintained by the company that made your operating system. You do not need a separate antivirus program unless you are doing something unusually risky, like downloading files from untrusted sources regularly. If you do install additional antivirus software, choose a well-known brand like Norton, McAfee, or Kaspersky, and be aware that it will slow down your computer slightly.

Frequently Asked Questions

Can a file be safe one day and unsafe the next?

Yes. If a security vulnerability is discovered in the program that opens the file, that file can become unsafe until you update the program. A Word document is safe until Microsoft releases a security update that patches a macro vulnerability, at which point older documents might become exploitable. This is why keeping your operating system and programs updated is important.

Is it safe to open an attachment from someone I know?

Not automatically. Email accounts and messaging apps get hacked regularly, and attackers use them to send malware to everyone in the contacts list. If you receive an unexpected attachment, especially a program or script, contact the person through a different method to confirm they actually sent it. Ask them what the file is and why they are sending it.

What does "This app is from an unidentified developer" mean on Mac?

It means the program does not have a digital signature from a developer that Apple recognizes. This can happen with legitimate software from small companies or open-source projects, but it is also common with malware. If you trust the source, you can Control+click the file and select "Open" to bypass the warning. If you are unsure, search the program name online to see what other users say about it.

Is it safe to read programs from a third-party app store?

Third-party app stores vary widely in safety. The official Microsoft Store, Apple App Store, and Google Play Store all review programs before listing them and remove malware quickly. Other app stores may not review programs at all. If you want a program, go to the official website of the company that made it, or use the official app store for your operating system.

What should I do if I opened a file I think might be malicious?

Do not panic — opening a file does not automatically infect your computer. Run a full scan with Windows Defender (Windows) or Activity Monitor (Mac) to check for suspicious activity. Disconnect from the internet while the scan runs if you are very concerned. If the scan finds nothing, you are almost certainly fine. If it finds threats, follow the prompts to remove them.